TraceOS: Building a Zero-Trust Multimodal Forensics Fleet with Gemini and Google Cloud

kuto — Mon, 31 Aug 2026 08:12:12 +0000

This article was created for the purposes of entering the All Things Agentic Hackathon.

TraceOS: Building a Zero-Trust Multimodal Forensics Fleet with Gemini and Google Cloud

Security teams rarely suffer from a lack of alerts. They suffer from fragmented evidence, slow handoffs, and AI-generated conclusions that are difficult to defend.

TraceOS is a zero-trust, multimodal forensic control plane built for the Fortified Enterprise Fleet category. It coordinates a governed fleet of specialist agents that can examine synthetic image evidence, correlate it with Cloud Audit Logs, reject unsupported claims, preserve case state, and produce an evidence-linked report.

The problem: useful autonomy without blind trust

An incident investigation can involve identity events, endpoint telemetry, network activity, screenshots, cloud audit records, and analyst notes. A single general-purpose agent may summarize those sources quickly, but speed is not enough when an unsupported sentence could trigger a costly response.

TraceOS is designed around a stricter rule: an agent may propose an observation, but only an independent verifier may create a finding. Every claim must point to registered evidence, and the UI must make both successful and rejected reasoning understandable to a human investigator.

A four-stage investigation that people can inspect

The canonical CASE-042 replay presents the investigation in four plain-language lanes:

Evidence entered — an image, log event, or case note is registered with provenance and a SHA-256 hash.
Agents observed — bounded specialists extract directly observable facts without declaring an incident finding.
Hypotheses tested — observations are correlated across modalities and checked against registered evidence.
Finding verified — only the independent verifier can promote a supported hypothesis into the final report.

An intentionally unsupported reference, EVID-019, visibly stops before the verified lane. That rejection is not hidden as an internal error; it becomes part of the auditable investigation record.

Architecture on Google Cloud

The public application runs as one scale-to-zero Cloud Run service. A statically exported Next.js interface is served by FastAPI, while Firestore stores durable case and integration state. Pub/Sub accepts signed Cloud Audit Log deliveries, Cloud Storage holds private versioned evidence, Cloud Logging provides operational records, and Vertex AI supplies the model layer.

The agent fleet is also deployed as a managed Gemini Enterprise Agent Platform Agent Runtime in northamerica-northeast1. It packages a Google Agent Development Kit coordinator and ten evidence-bounded forensic specialists with runtime identity and telemetry. Separating the public control plane from managed agent execution means a case can expose failures honestly and resume without losing verified state.

The main model path uses Gemini 3.7 Flash for report generation and Gemini 3.5 Flash in the managed ADK runtime. The system records model-integration status so a restart cannot turn a real connection into an ambiguous UI claim.

How the agents collaborate with the investigator

The human investigator controls the objective, approved evidence, and operational response. The coordinator delegates only bounded tasks: visual analysis, identity correlation, endpoint analysis, network analysis, evidence integrity, independent verification, and reporting.

The boundaries matter:

Specialist agents write observations, not findings.
Hypotheses must cite evidence IDs in the case registry.
The verifier is the only component with finding-write authority.
The reporting agent receives verified findings and an approved timeline instead of unrestricted raw evidence.
Post-verification training media is isolated and labeled NOT EVIDENCE.

This makes the collaboration visible. The investigator can select any replay node to see its source, event time, hash, confidence, extracted observation, and verifier outcome.

Failure handling is part of the product

TraceOS does not replace missing evidence with a convenient fallback story. A failed image analysis remains ANALYSIS_FAILED. A duplicate audit event is deduplicated using its source identifier. A worker that returns an unsupported reference triggers a bounded replay using registered evidence. If the report agent requests raw endpoint data, the policy gateway denies the request and the agent retries through its permitted verified_findings scope.

Case memory is durable as well. The demo resumes the same investigation seven days later, retaining verified facts and the unresolved question instead of restarting from a blank prompt.

Multimodal evidence without turning generated media into evidence

Gemini vision extracts OCR and directly observable visual regions from a clearly watermarked synthetic investigation image. Those observations still cannot enter the report until they correlate with Cloud Audit evidence and pass independent verification.

TraceOS also integrates three additional Google AI model families in a one-way training branch:

Gemma independently challenges the verified report using evidence identifiers.
Veo creates a post-incident reconstruction for training.
Lyria creates tabletop-exercise audio.

These generated artifacts cannot write back to evidence or findings. The cached CASE-042 training pack records a total cost of $0.442, and the public deployment keeps the three adapters disabled after the proof run to protect the project’s $5 hosting budget.

Honest security and integration states

Enterprise demos become less trustworthy when configuration is presented as enforcement. TraceOS reports the distinction directly:

Cloud Audit Logs are CONNECTED.
The managed Agent Runtime and Agent Identity are VERIFIED.
The Agent Gateway resource is CONFIGURED; no unavailable managed authorization-policy claim is made.
Model Armor is LOCAL_FALLBACK because managed template creation was denied in the project.
Security Command Center is NOT_CONNECTED until notification authentication is verified.

Synthetic fixtures are labeled DEMO_SYNTHETIC, and live records retain source metadata. That provenance is visible in the application and its APIs.

What I learned

The most important architectural lesson was that multi-agent quality comes from enforceable boundaries, not from adding more personas. Typed handoffs, evidence registries, idempotent event ingestion, one authorized finding writer, and explicit failure states made the fleet more useful than a long conversational chain.

The second lesson was visual: an evidence graph only helps when a judge or investigator can understand it immediately. The four-lane replay, recognizable evidence cards, rejected-claim stops, and accessible 2D fallback turn system behavior into something a person can audit.

Finally, production readiness is a product feature. Scale-to-zero hosting, bounded model output, cached public runs, cost circuit breakers, health endpoints, and honest connection labels make the demo reproducible without pretending every optional enterprise integration is available.

Test the investigation

Open the live TraceOS console, run the evidence replay, open CASE-042, and follow the path from the image observation to the verified account-and-workstation anomaly. Then select the red EVID-019 node and confirm that it never enters the verified-finding lane.

TraceOS demonstrates a simple principle: autonomous investigation becomes operationally useful when every conclusion can show where it came from, what challenged it, and who—or what—was allowed to approve it.

Watch the walkthrough: https://youtu.be/qaxW8RbtRao
Explore the source: https://github.com/foundator779/TraceOS

DEV Community: kuto

TraceOS: Building a Zero-Trust Multimodal Forensics Fleet with Gemini and Google Cloud

TraceOS: Building a Zero-Trust Multimodal Forensics Fleet with Gemini and Google Cloud

The problem: useful autonomy without blind trust

A four-stage investigation that people can inspect

Architecture on Google Cloud

How the agents collaborate with the investigator

Failure handling is part of the product

Multimodal evidence without turning generated media into evidence

Honest security and integration states

What I learned

Test the investigation

AllThingsAgenticHackathon